Versions (relevant - OpenSearch/Dashboard/Server OS/Browser):
opensearch-2.5.0-1.x86_64
Describe the issue:
Getting this every 15 minutes in the log:
Mar 01 15:35:56 systemd-entrypoint[792]: uncaught exception in thread [DefaultDispatcher-worker-4]
Mar 01 15:35:56 systemd-entrypoint[792]: AlertingException[analyzer [rule_analyzer] has not been configured in mappings]; nested: Exception[java.lang.IllegalArgumentException: analyzer [rule_analyzer] has not been configured in mappings];
Mar 01 15:35:56 systemd-entrypoint[792]: at org.opensearch.alerting.util.AlertingException$Companion.wrap(AlertingException.kt:70)
Mar 01 15:35:56 systemd-entrypoint[792]: at org.opensearch.alerting.util.DocLevelMonitorQueries.updateQueryIndexMappings(DocLevelMonitorQueries.kt:359)
Mar 01 15:35:56 systemd-entrypoint[792]: at org.opensearch.alerting.util.DocLevelMonitorQueries.access$updateQueryIndexMappings(DocLevelMonitorQueries.kt:41)
Mar 01 15:35:56 systemd-entrypoint[792]: at org.opensearch.alerting.util.DocLevelMonitorQueries$updateQueryIndexMappings$1.invokeSuspend(DocLevelMonitorQueries.kt)
Mar 01 15:35:56 systemd-entrypoint[792]: at kotlin.coroutines.jvm.internal.BaseContinuationImpl.resumeWith(ContinuationImpl.kt:33)
Mar 01 15:35:56 systemd-entrypoint[792]: at kotlinx.coroutines.DispatchedTask.run(Dispatched.kt:285)
Mar 01 15:35:56 systemd-entrypoint[792]: at kotlinx.coroutines.scheduling.CoroutineScheduler.runSafely(CoroutineScheduler.kt:594)
Mar 01 15:35:56 systemd-entrypoint[792]: at kotlinx.coroutines.scheduling.CoroutineScheduler.access$runSafely(CoroutineScheduler.kt:60)
Mar 01 15:35:56 systemd-entrypoint[792]: at kotlinx.coroutines.scheduling.CoroutineScheduler$Worker.run(CoroutineScheduler.kt:742)
Mar 01 15:35:56 systemd-entrypoint[792]: Caused by: java.lang.Exception: java.lang.IllegalArgumentException: analyzer [rule_analyzer] has not been configured in mappings
Mar 01 15:35:56 systemd-entrypoint[792]: ... 9 more
Configuration:
rpm install. I attempted to setup security analytics, but then tried to remove any configuration. I suspect something is left over.
Also, I don’t know why the journal is reporting the process name as “systemd-entrypoint”. It is the opensearch process.